" Linux " does Rm-rf run road? Nonexistent = " Extundelete will restore

Write this article, because cut the body to meet,be, firm introduction when the operation that became direct below the circumstance of Mount Rm -rf, at a draught cutout the accessory of 700G, that moment is direct muddled, remedy with small companionate the same night later, not bad the project still is done not have on line, did a frequency to occupy migratory ~ afresh

Because of the reason above, how to consider technically later to remedy after Rm -rf? Did the following test with fictitious machine, those who use is Extundelete this covers program, practical. Young nevertheless associate people must not take manufacturing environment to try, restore not to come back not to say to know me!

Can pass below Linux " Ls -id " the command will examine a certain document or the Inode value of catalog, examine the Inode cost of a catalog for example, can input:

Examine Inode

Do not depend on specific file format when using Extundelete to restore a file, above all the Inode information that Extundelete can pass file system (the Inode of root catalog is commonly 2) the information that will obtain all documents below current file system, include existence with the file that has deleted, these information include file name and Inode.

Use Inode information to tie the Block place that the log goes to inquiring this Inode is in next, include direct piece, indirect piece wait for information.

Use Dd to command these information backup comes out finally, restore data file thereby.

The file of 1.extundelete restores a tool, this tool most give power supported partition of Ext3/ext4 double format to restore namely.

2.In the course resumes on real wire, do not install Extundelete you by accident the file of cutout is in hard disk, the data that so can certain odds will need to restore is enclothed thoroughly.

3.Extundelete still has very big not integrality, the refreshment that is based on whole disk the function is relatively powerful, the refreshment that is based on catalog and file is not quite powerful still.

4.Extundelete is carried out after ending, catalog of a RECOVERED_FILES is produced in present list, the file that restores to come out is namely inside, still include folder.

5. any the file restores a tool, before use, the partition that all wants to will restore is uninstalled or hang carry for read-only, prevent data to be enclothed to use.

Umount /dev/partition

Mount -o Remount, ro /dev/partition

Extundelete homepage: Http://extundelete.sourceforge.net/

1, download Extundelete

Download address: Http://nchc.dl.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2- - 0.2.4 version

[Total dosage of Root@node1 Opt]# Cd Extundelete/[root@node1 Extundelete]# Ll 108-rw-r- - R- - 24 05:0 of month of 1 Root Root 108472 54 Extundelete-0.2.4.tar.bz2[root@node1 Extundelete]# Tar -xvf Extundelete-0.2.4.tar.bz2 Extundelete-0.2.4/extundelete-0.2.4/acinclude.m4extundelete-0.2.4/missingextundelete-0.2.4/autogen.shextundelete-0.2.4/aclocal.m4extundelete-0.2.4/configureextundelete

2, compile installation

[Total dosage of Root@node1 Extundelete]# Cd Extundelete-0.2.4[root@node1 Extundelete-0.2.4]# Ll 356-rw-r- - R- - 3 2012 Acinclude.m4-rw-r of month of 1 1000 1000 3283 11- - R- - 31 2012 Autogen.sh-rw-r of month of 4 2013 Aclocal.m4-rwxr-xr-x 1 1000 1000 372 12 of month of 1 1000 1000 0 1- - R- - 4 2013 Config.h.in-rwxr of month of 1 1000 1000 4780 1- - R- - 4 2013 Configure-rw-r of month of 1 1000 1000 231557 1- - R- - 4 2013 Install-sh-rw-r of month of 4 2013 Depcomp-rwxr-xr-x 1 1000 1000 13998 1 of month of 31 2012 Configure.ac-rwxr-xr-x 1 1000 1000 20334 1 of month of 1 1000 1000 5357 12- - R- - 3 2012 LICENSE-rw-r of month of 1 1000 1000 17987 11- - R- - 31 2012 Makefile.am-rw-r of month of 1 1000 1000 916 12- - R- - 4 2013 Missing-rw-r of month of 4 2013 Makefile.in-rwxr-xr-x 1 1000 1000 10346 1 of month of 1 1000 1000 23644 1- - R- - 4 2013 Src[root@node1 Extundelete-0.2.4]# of month of 3 2012 READMEdrwxr-xr-x 2 1000 1000 4096 1 of month of 1 1000 1000 1666 11. / Configure- - Prefix=/usr/local/extundeleteConfiguring Extundelete 0.2.4configure: Error: Can't Find Ext2fs Library

The newspaper is wrong: Configure: Error: Can't Find Ext2fs Library

Because Extundelete depends on E2fsprogs, need installs E2fsprogs first

[Root@node1 Extundelete-0.2.4]# Yum -y Install E2fsprogs E2fsprogs-develLoaded Plugins: Product-id, refresh-packagekit, security, subscription-managerThis System Is Not Registered To Red Hat Subscription Management. You Can Use Subscription-manager To Register.Setting Up Install ProcessPackage E2fsprogs-1.41.12-18.el6.x86_64 Already Installed And Latest Version. . . . . . 

After installing E2fsprogs again Configure is successful.

[Root@node1 Extundelete-0.2.4]# . / Configure- - Prefix=/usr/local/extundelete &&Make &&Make InstallConfiguring Extundelete 0.2.4Writing Generated Files To Diskmake -s All-recursiveMaking All In Srcextundelete.cc:571: Warning: Untapped parameter ' Flags ' Making Install In Src /usr/bin/install -c Extundelete '/usr/local/extundelete/bin'

3. examines tool version

[Total dosage of Root@node1 Extundelete-0.2.4]# Cd /usr/local/extundelete/bin/[root@node1 Bin]# Ll 24 05:0 of month of 1160-rwxr-xr-x 1 Root Root 1187055 59 Extundelete[root@node1 Bin]# . / Extundelete -vextundelete Version 0.2.4libext2fs Version 1.41.12Processor Is Little Endian. 

1.Establish file system

 Mkfs -t Ext4 /dev/sdb1

2. examines file system type

[Root@node1 ~]# Fdisk -l? Disk /dev/sda: 64.4 GB, 64424509440 Bytes255 Heads, 63 Sectors/track, 7832 CylindersUnits = Cylinders Of 16065 * 512 = 8225280 BytesSector Size (logical/physical) : 512 Bytes / 512 BytesI/O Size (minimum/optimal) : 512 Bytes / 512 BytesDisk Identifier: 0x000d2842? Device Boot Start End Blocks Id System/dev/sda1 * 1 26 204800 83 LinuxPartition 1 Does Not End On Cylinder Boundary. / Dev/sda2 26 287 2097152 82 Linux Swap / SolarisPartition 2 Does Not End On Cylinder Boundary. / Dev/sda3 287 7833 60611584 83 Linux[root@node1 ~]# Blkid /dev/sda1/dev/sda1: UUID="14e9f1ea-0326-47ef-8c35-325a6fb7186d" TYPE="ext4" [root@node1 ~]# Blkid /dev/sda3/dev/sda3: UUID="faab01ae-3d46-49dd-932f-837c8f45e5c0" TYPE="ext4" [root@node1 ~]# Blkid /dev/sda2/dev/sda2: UUID="48b4bdaa-460e-468e-9102-fc3d4d3ca69b" TYPE="swap "

Also can use below the method is examined

[Root@node1 ~]# File -s /dev/sda1 /dev/sda1: Linux Rev 1.0 Ext4 Filesystem Data (needs Journal Recovery) (extents) (huge Files)[root@node1 ~]# File -s /dev/sda3 /dev/sda3: Linux Rev 1.0 Ext4 Filesystem Data (needs Journal Recovery) (extents) (large Files) (huge Files)[root@node1 ~]# File -s /dev/sda2 /dev/sda2: Linux/i386 Swap File (new Style) 1 (4K Pages) Size 524287 Pages

3. founds catalog of a Delete, hang carry the file system that just established to go up, found a file, delete a file next

[Root@node1 Home]# Mkdir Delete[root@node1 Home]# Mount /dev/sda1 /home/delete/[root@node1 Home]# Mount/dev/sda3 On / Type Ext4 (rw)proc On /proc Type Proc (rw)sysfs On /sys Type Sysfs (rw)devpts On /dev/pts Type Devpts (rw, gid=5, mode=620)tmpfs On /dev/shm Type Tmpfs (rw)/dev/sda1 On /boot Type Ext4 (rw)none On /proc/sys/fs/binfmt_misc Type Binfmt_misc (rw).host:/ On /mnt/hgfs Type Vmhgfs (rw, ttl=1)vmware-vmblock On /var/run/vmblock-fuse Type Fuse.vmware-vmblock (rw, nosuid, nodev, default_permissions, allow_other)/dev/sr0 On /mnt/cdrom Type Iso9660 (ro)gvfs-fuse-daemon On /root/.gvfs Type Fuse.gvfs-fuse-daemon (rw, nosuid, total dosage of Nodev)/dev/sda1 On /home/delete Type Ext4 (rw)[root@node1 Delete]# Ll 28333-rw-r- - R- - . 11 2013 Config-2.6.32-431.el6.x86_64drwxr-xr-x of month of 1 Root Root 105195 11. 6 23:4 of month of 3 Root Root 1024 26 Efidrwxr-xr-x. 7 00:3 of month of 2 Root Root 1024 27 Grub-rw-------. 9 21:4 of month of 1 Root Root 17533084 23 Initramfs-2.6.32-431.el6.x86_64.img-rw-------. 7 00:3 of month of 1 Root Root 4505771 28 Initrd-2.6.32-431.el6.x86_64kdump.imgdrwx------. 6 23:3 of month of 2 Root Root 12288 27 Lost+found-rw-r- - R- - . 11 2013 Symvers-2.6.32-431.el6.x86_64.gz-rw-r of month of 1 Root Root 193758 11- - R- - . 11 2013 System.map-2.6.32-431.el6.x86_64-rwxr-xr-x of month of 1 Root Root 2518236 11. 11 2013 Vmlinuz-2.6.32-431.el6.x86_64[root@node1 Delete]# Vi Index.txt # of month of 1 Root Root 4128944 11 adds data [Root@node1 Delete]# Rm -rf Index.txt

4. uninstalls partition

If the attention is / the cutout of root catalog, hang disk carry other machine to do restore

[Root@node1 Bin]# Fuser -m -v /home/delete/ [root@node1 Bin]# Fuser -k /home/delete/ <- - the process that the end uses some partition is cultivated [Root@node1 Bin]# Umount /home/delete/ <- - uninstall partition

[Root@zw_test_26_74 ~]# Umount /dev/sdb3

5. uses Extundelete to examine the document that exists on partition

Extundelete- - Inode 2 /dev/sdb2

#- - Inode is the content in searching some I node, use 2 specifications to be a search, if need to enter catalog search, simply should appoint catalog I node can

[Root@node1 Bin]# . / Extundelete- - Inode 2 /dev/sda1 NOTICE: Extended Attributes Are Not Restored.WARNING: EXT3_FEATURE_INCOMPAT_RECOVER Is Set.The Partition Should Be Unmounted To Undelete Any Files Without Further Data Loss.If The Partition Is Not Currently Mounted, this Message Indicates It Was Improperly Unmounted, and You Should Run Fsck Before Continuing.If You Decide To Continue, extundelete May Overwrite Some Of The Deletedfiles And Make Recovering Those Files Impossible. You Should Unmount Thefile System And Check It With Fsck Before Using Extundelete.Would You Like To Continue? (Y/n) YLoading Filesystem Metadata. . . 25 Groups Loaded.Group: 0Contents Of Inode 2:0000 | 6d 41 00 00 00 04 00 00 Ae A4 24 59 97 A3 24 59 | MA. . . . . . . . $Y. . $Y0010 | 97 A3 24 59 00 00 00 00 00 00 05 00 04 00 00 00 | . . $Y. . . . . . . . . . . .0020 | 00 00 00 00 1b 00 00 00 23 11 00 00 00 00 00 00 | . . . . . . . . # . . . . . . .0030 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | . . . . . . . . . . . . . . . .0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | . . . . . . . . . . . . . . . .0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | . . . . . . . . . . . . . . . .0060 | 00 00 00 00 00 00 00 00 31 11 00 00 00 00 00 00 | . . . . . . . .1. . . . . . .0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | . . . . . . . . . . . . . . . . ? Inode Is AllocatedFile Mode: 16749Low 16 Bits Of Owner Uid: 0Size In Bytes: 1024Access Time: 1495573678Creation Time: 1495573399Modification Time: 1495573399Deletion Time: 0Low 16 Bits Of Group Id: 0Links Count: 5Blocks Count: 4File Flags: 0File Version (for NFS) : 0File ACL: 4401Directory ACL: 0Fragment Address: 0Direct Blocks: 4387, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0Indirect Block: 0Double Indirect Block: 0Triple Indirect Block: 0? File Name | Inode Number | Deleted Status. 2. . 2lost+found 11grub 12efi 19.index.txt.swp 24 Deleted.vmlinuz-2.6.32-431.el6.x86_64.hmac 14System.map-2.6.32-431.el6.x86_64 15config-2.6.32-431.el6.x86_64 16symvers-2.6.32-431.el6.x86_64.gz 17vmlinuz-2.6.32-431.el6.x86_64 18initramfs-2.6.32-431.el6.x86_64.

The Index.txt that mark is Deleted above is by accident the data of cutout

6.Restore

[Root@node1 Bin]# . / Extundelete- - Restore-all /dev/sda1NOTICE: Extended Attributes Are Not Restored.WARNING: EXT3_FEATURE_INCOMPAT_RECOVER Is Set.The Partition Should Be Unmounted To Undelete Any Files Without Further Data Loss.If The Partition Is Not Currently Mounted, this Message Indicates It Was Improperly Unmounted, and You Should Run Fsck Before Continuing.If You Decide To Continue, extundelete May Overwrite Some Of The Deletedfiles And Make Recovering Those Files Impossible. You Should Unmount Thefile System And Check It With Fsck Before Using Extundelete.Would You Like To Continue? (Y/n) YLoading Filesystem Metadata. . . 25 Groups Loaded.Loading Journal Descriptors. . . 89 Descriptors Loaded.Searching For Recoverable Inodes In Directory / . . . 2 Recoverable Inodes Found.Looking Through The Directory Structure For Deleted Files. . . Unable To Restore Inode 24 (.index.txt.swp) : Space Has Been Reallocated.0 Recoverable Inodes Still Lost. [Total dosage of Root@node1 Bin]# Ll 24 05:0 of month of 1164-rwxr-xr-x 1 Root Root 1187055 524 05:1 of month of 9 Extundeletedrwxr-xr-x 2 Root Root 4096 5Total dosage of 8 RECOVERED_FILES[root@node1 Bin]# Ll RECOVERED_FILES/ 4-rw-r- - R- - 24 05:1 of month of 1 Root Root 47 58 Index.txt

Can see Index.txt has restored to fall to RECOVERED_FILES catalog.

After the data that discovers a certain partition is deleted by accident, wanting the first thing that do is to be uninstalled immediately be deleted by accident the partition that the file is in, new perhaps with read-only means is hanged carry this partition.

So the matter that become actually very simple: Delete a file, it is file Inode node medium fan district index keeps clear of, in the meantime, the data that releases these data correspondence piece, and actual document still is put in staying in disk partition. But these files that are deleted can be not put all the time certainly in staying in disk, the data that releases when these piece by operating system reapportion when, those data that are deleted can be enclothed. Accordingly, delete by accident in data hind, the venture that coverture of the data in uninstalling a file to be in partition to be able to reduce data piece immediately builds, raise a success to restore the machine of data to lead then.

Finally, wish everybody does not use Extundelete forever!

Feel useful take an attention ~